AML Typologies: 13 Patterns, the Rules That Flag Them and Real Cases

AML typologies describe how criminal proceeds move until they pass for ordinary funds: which accounts and instruments carry the money, and in what order it moves between counterparties. For a monitoring team the catalogue also measures coverage, since a programme flags only the methods its scenarios were written to find. FIU-India has made the point in several penalty orders, among them the October 2024 Union Bank of India order, citing a failure to evolve an internal mechanism to detect and report suspicious transactions as Rule 7(3) of the PML (Maintenance of Records) Rules, 2005 requires.

Published lists of money laundering typologies tend to end at a definition and a few warning signs. This post takes thirteen and, for each, describes how the method shows up in an account, the rule that would flag it and the data the rule needs. Every entry closes on a real case from FIU-India, the Enforcement Directorate (ED) or another regulator or prosecutor; eight of the thirteen are Indian. Where a case has produced no conviction or regulator's finding, it is described as an allegation.

What AML typologies are, and how they differ from red flags

An AML typology is a recurring method of laundering money or financing terrorism, described in enough detail for a reporting entity to recognise it in its own data. A red flag sits one level below: it is a single observable sign that such a method may be in use. One typology throws off several red flags. Structuring, for instance, can appear as near-threshold deposits, as several depositors feeding one account, or as one day’s deposits spread across branches.

No indicator proves much in isolation, which is why FinCEN's 2014 funnel account advisory tells institutions to read indicators in combination and against expected activity. KYC Hub's guide to AML red flags catalogues the individual signs. Scenario design happens one level up, at the typology.

A few publishers account for most documented typologies.

• FATF, often with partners: Trade-based Money Laundering: Trends and Developments (with the Egmont Group, December 2020), Illicit Financial Flows from Cyber-enabled Fraud (with INTERPOL and the Egmont Group, November 2023) and its September 2020 red flag indicators for virtual assets.
• FIU-India. Reporting entities in its priority intimation framework submit the typologies they observe, and FIU-India develops them into operational analysis. Its Annual Report 2023-24 records guidance on cyber-enabled fraud and mule accounts; sanitised cases appear across the annual reports.
• The Egmont Group. Its Best Egmont Cases: Financial Analysis Cases 2021-2023, published in 2024, collects financial-analysis cases submitted by member FIUs.
• AMLTRIX, an open-source framework launched in 2025 by the vendor AMLYZE, offers a scheme of tactics, techniques, indicators and mitigations that teams can use to label a scenario library.

Enforcement orders and prosecution releases are often the most specific source of all, recording what one particular account did. Wider worked examples are collected in examples of money laundering.

The 13 typologies at a glance

AML typologies and the monitoring rules that flag them

Each entry below follows the same four parts: account pattern, rule, data, case. When an auditor asks what a given scenario is for, the entries also serve as transaction monitoring examples.

1. Structuring and smurfing

In the account. A customer splits cash into amounts just under a reporting or internal review threshold and pays them in on consecutive days, across branches or cash deposit machines. In smurfing, several depositors feed one account or a linked cluster; smurfing vs structuring sets out where one ends and the other begins.

The rule. A customer's accounts receive at least three cash deposits within any seven days, each between 80% and 100% of a defined threshold. A second version flags cash paid into one account by several depositors at two or more branches on the same day. India's PML Rules already cover part of this ground: under Rule 3(1)(B), as FIU-India's FAQs set out, integrally connected cash transactions individually below ₹10 lakh whose monthly aggregate exceeds ₹10 lakh are captured in the cash transaction report. The scenario adds the intent behind the split, which belongs in a suspicious transaction report.

The data it needs. Cash transaction records showing the channel (branch counter, ATM or cash deposit machine), location and timestamp, with depositor identity where captured and a map of the accounts linked to each customer.

Case. Commonwealth Bank of Australia (CBA) agreed with AUSTRAC in June 2018 to an A$700 million penalty over its Intelligent Deposit Machines, which investigations with Australian police had found being used to launder criminal proceeds. According to AUSTRAC's release, CBA admitted 53,750 contraventions.

2. Rapid movement and pass-through accounts

In the account. Money arrives and departs within hours, or a day at most, so the balance hovers near zero while turnover far exceeds what the declared business or capital could support. Credits come from one source or a few; debits go to related parties, sometimes in a loop.

The rule. For accounts whose monthly turnover exceeds a set multiple of declared turnover or capital, the scenario fires when outflows reach at least 90% of inflows within 48 hours and the pattern persists across a review window. Counterparties sharing a registered address, director or beneficial owner with the customer raise the priority.

The data it needs. Timestamps on inbound and outbound legs, the turnover and capital declared at onboarding, counterparty identifiers, and registry records of directors, registered addresses and beneficial owners.

Case. In Order-in-Original No. 13/DIR/FIU-IND/2024, dated 1 October 2024, the Director of FIU-India found the charges against Union Bank of India substantiated and imposed a ₹54 lakh penalty. An NBFC and associated entities under common control, with a common registered address and identical beneficial owners, used current accounts at the bank's Hill Road branch in Mumbai for substantial circular fund transfers. Authorised capital stood at ₹1 lakh apiece, yet credit turnover bore no proportion to the declared business, and RTGS inflows from the NBFC passed swiftly to other group entities. Alerts fired on these accounts; the bank closed them with minimal justification and filed one STR.

3. Money mule networks

In the account. Recently opened accounts in different names share a mobile number, address, device or IP address. Transfers from one source or a handful drain away quickly by ATM withdrawal or onward transfer, with almost no ordinary spending. Signals particular to Indian payment rails are discussed in how to detect mule accounts.

The rule. The scenario targets accounts under 90 days old that receive transfers from a common remitter and move at least 80% of the amount out within 24 hours, by withdrawal or transfer. Once two or more such accounts share a mobile number, address or device, the alert escalates.

The data it needs. KYC contact details (mobile number, address, email), device and IP data from digital onboarding and login, account opening dates and ATM withdrawal logs, with counterparty account identifiers comparable across customers.

Case. A reporting entity's typology submission, recorded in FIU-India's Annual Report 2024-25, showed a Forest Range Officer sending NEFT transfers to numerous newly opened savings accounts in different individuals' names, followed immediately by ATM cash withdrawals. Several shared a mobile number and registered addresses. FIU-India's analysis linked the officer to suspected money laundering, corruption and wildlife trafficking, and the law enforcement agency that received it opened a preliminary investigation. Its searches recovered ATM cards of mule accounts, devices, documents and a suspected tiger skin. The report records an investigation and no conviction.

4. Funnel accounts

In the account. Many cash deposits reach an individual or business account across cities or states, often below the reporting threshold and by someone other than the holder, and the money soon leaves from a different location, at times through a consolidating account that several funnels feed. FinCEN described the pattern in May 2014 in advisory FIN-2014-A005.

The rule. Over 30 days, depositors other than the account holder pay cash into a single account at branches in three or more cities or states outside its home region. A withdrawal or outbound wire within a few days completes the trigger.

The data it needs. The location of each deposit and the depositor's identity checked against the account holder's, the account's home branch and region, and beneficiary data on outbound wires.

Case. TD Bank settled with FinCEN on 10 October 2024 for $1.3 billion, the largest penalty FinCEN has levied on a depository institution. The bank admitted wilfully failing to maintain an AML programme meeting the Bank Secrecy Act's minimum requirements. According to FinCEN, the bank knew of significant funnel account activity involving high-risk countries and did not act in time. In 2021 an employee who was taking bribes opened numerous accounts, some of them for shell companies, and millions of dollars in funnel activity passed through those accounts in a high-risk jurisdiction where the bank had no operations.

5. Dormant accounts that suddenly turn active

In the account. After months or years without customer-initiated activity, the account is reactivated and shows large movements, new contact details or new beneficiaries. In the insider variant, bank staff reactivate it without any customer request.

The rule. For accounts inactive for 12 months or longer, any transaction within 30 days of reactivation above a set multiple of the historical average balance raises an alert, as does a new beneficiary or a change of contact details. Staff reactivations with no customer request on file fall under a separate scenario.

The data it needs. Two fields carry most of the weight: the date of the customer's last initiated transaction and the user ID behind the reactivation. The KYC change log, beneficiary log and historical balances support them.

Case. South Africa's National Prosecuting Authority announced charges in July 2022 against two former Absa bank employees, covering 31 counts of fraud, 80 of theft and 90 of money laundering. The charges allege that the pair opened accounts in the names of deceased persons and of a foreign national whose passport had expired, then moved amounts of between R4,500 and R370,000 into them from dormant client accounts.

6. Unusual cash activity against the customer's profile

In the account. Cash volumes sit out of line with the declared business or the customer's peers. Heavy cash deposits in a sector where the law caps cash sales are one form; large cash sums arriving in a salaried individual's account are another. From there the cash moves on to related entities.

The rule. The alert fires when, for two consecutive months, the customer's monthly cash deposits exceed a set multiple of its declared monthly turnover or rank above the 95th percentile for its peer segment (industry and size band).

The data it needs. The declared profile (income or turnover, and industry), peer-segment statistics, cash transaction history including CTR data, and counterparty flows.

Case. A tactical analysis of gold and bullion traders appears in FIU-India's Annual Report 2024-25. Several entities had received funds from another that recorded substantial cash deposits, which raised the suspicion that statutory limits on cash in bullion sales were being breached. FIU-India examined every account flagged in STRs and CTRs and shared a fund-flow analysis with a law enforcement agency. When that agency acted against bullion traders in several cities, it uncovered suspected tax evasion that FIU-India puts in the thousands of crores of rupees.

7. Cross-border layering and wire transfers to high-risk jurisdictions

In the account. Non-resident or offshore-owned customers push large wires through the account to shell company counterparties, frequently in round amounts and via several jurisdictions. There is little domestic activity, and money often leaves within days.

The rule. Cross-border wires above a set value, to or from jurisdictions on the entity's high-risk list, are flagged if the counterparty is new or the payment passes through two or more intermediary jurisdictions. Priority rises for round-figure amounts and funds that leave within days of arriving. In India, cross-border wire transfers above ₹5 lakh with an origin or destination in India are already reportable to FIU-India under Rule 3(1)(E) of the PML (Maintenance of Records) Rules, as its FAQs set out, and the scenario adds risk logic on top.

The data it needs. Payment message fields for originator, beneficiary, intermediary banks and country codes, read against the entity's jurisdiction risk list and the customer's residency and ownership data.

Case. Danske Bank pleaded guilty in the United States on 13 December 2022 to conspiracy to commit bank fraud and agreed to forfeit $2 billion. Its admissions describe an Estonian branch that let non-resident customers move large sums with little oversight between 2008 and 2016. Employees conspired with those customers to shield their transactions, in part through shell companies that obscured ownership, and the branch processed $160 billion through U.S. banks for that portfolio; the figure describes volume processed, not an established total of laundered proceeds. The plea was for defrauding U.S. banks about the branch’s AML controls.

8. Shell and front companies

In the account. Newly formed companies or proprietorships with minimal capital and no visible operations report turnover that their declared activity cannot explain, and often share addresses, signatories or phone numbers. Money circulates within the group against invoices with no goods behind them, until the chain ends in cash withdrawals.

The rule. On business accounts less than 12 months old, the scenario fires when first-quarter turnover exceeds a set multiple of paid-up capital or declared turnover. Escalation follows if the entity shares a registered address, director, authorised signatory or mobile number with two or more of the customers it transacts with.

The data it needs. Corporate registry data (incorporation date, directors, capital, registered address) and, where available, GST registration and filing data, plus KYC contact data compared across customers and a counterparty graph.

Case. FIU-India's Annual Report 2023-24 describes an operational analysis built from STRs. It observed that 38 proprietorship firms declared as service providers had run complex transactions worth more than ₹200 crore, which it assessed as layering, and that large cash withdrawals followed from entities declared as agricultural businesses. One of the law enforcement agencies that received the analysis identified what it described as 27 bogus firms. Those firms had allegedly issued invoices worth ₹701 crore without supplying goods, and the alleged GST evasion came to ₹107 crore. Of the twelve individuals named, two were arrested; the report records no conviction.

9. Trade-based money laundering

In the account. Import and export payments fail to match the trade documents. An advance remittance may have no matching bill of entry, or invoice prices may sit far from market values. Sometimes the goods or counterparties fall outside the customer's line of business, or third parties make or receive the payments.

The rule. The core scenario flags advance import remittances with no matching bill of entry recorded within the expected period. Variants flag trade payments whose counterparty sector or country does not fit the customer's declared trade, or unit prices that stray from a reference range by more than a set percentage.

The data it needs. Trade documents (invoice, bill of entry, shipping bill) and customs data. The pricing test relies on product codes and unit prices; counterparty country and sector feed the mismatch test. The FATF and Egmont trade-based money laundering risk indicators are grouped by business structure, trade activity, trade documents and commodities, and account and transaction activity, which maps closely to this data list.

Case. FIU-India's Annual Report 2023-24 includes an operational analysis on the misuse of bills of entry. A reporting bank had noticed bills of entry entered manually on a system portal, with no corresponding data on the server against the bank's AD code. The suspicion was that foreign remittances of about ₹16 crore were being used to route clandestine funds, and the analysis went to law enforcement and the regulator.

10. Hawala and informal value transfer

In the account. Hawala settles outside the banking system, so a bank sees only its edges: typically accounts in the names of people who do not control them, fed by credits from unrelated sources, from which cash leaves in volumes no business explains.

The rule. On business accounts with no cash-intensive activity, the scenario fires when large or frequent cash withdrawals follow a 30-day period in which unrelated third parties supplied most of the credits. The alert escalates if the person withdrawing is neither the account holder nor an authorised signatory.

The data it needs. Cash withdrawal records identifying who made each withdrawal, a counterparty analysis of credits, the declared business profile and linked accounts.

Case. The ED's Mumbai Zonal Office reported seizing ₹13.5 crore in cash in a press release dated 6 December 2024. The case began with an FIR over deposits of more than ₹100 crore into 14 newly opened accounts at Nashik Merchant Co-operative Bank in Malegaon, allegedly opened with the identity documents of people induced by false promises or payment. ED says most of the money went to 21 sole proprietary concerns, whose accounts received hundreds of crores of rupees, passed them to various firms and saw hundreds of crores withdrawn in cash. Two individuals allegedly withdrew cash from dummy entities' accounts and handed it to angadiyas and hawala operators in Ahmedabad, Mumbai and Surat. Both were arrested under section 19 of the PMLA. These are ED’s allegations. Later press reports describe a prosecution complaint and a Bombay High Court bail order for one accused, with the trial yet to begin.

11. Proceeds of cyber fraud

In the account. Victims pay, usually over UPI or IMPS, into first-layer mule accounts. The money is split within hours across further accounts and shell entities, and eventually leaves through cards used abroad or crypto purchases. FATF’s report on cyber-enabled fraud sets out risk indicators for this flow.

The rule. An alert is raised on any account that receives credits from ten or more distinct remitters with no prior relationship to it within 24 hours, then passes most of the amount on within hours. Escalation follows when that account, or another sharing its device or contact data, appears in a fraud complaint.

The data it needs. Payment-rail data such as UPI handles and remitter accounts, fraud complaint feeds, device and IP data, and card usage by country.

Case. ED announced the arrest of two chartered accountants under the PMLA in a press release dated 5 March 2026. It alleges that about ₹641 crore from investment, part-time job, QR code and phishing frauds was credited to mule accounts run by members of Telegram groups and then layered through dummy and shell entities. According to ED, the syndicate used debit cards issued by Indian banks to move the funds to the UAE-based PYYPL platform. There the money was either withdrawn overseas (particularly in Dubai, through ATMs and POS transactions) or converted to virtual digital assets on Binance. ED further says the syndicate controlled more than 20 entities operating from common addresses in Delhi, with overlapping partners and signatories. Ten people had been arrested and two prosecution complaints filed.

12. Virtual asset layering

In the account. Virtual digital assets (VDAs) arrive from unhosted wallets or unregistered offshore exchanges and are converted to rupees with little trading between. Withdrawals are spread across several linked bank accounts, logins come through VPNs and the volumes do not fit the user's profile. Indicators of this kind appear in FATF’s virtual asset red flag report, including assets spread across multiple accounts without a clear business reason.

The rule. VDA deposits above a set value from unhosted wallets or unregistered offshore exchanges are flagged when converted to fiat and withdrawn within 24 hours with minimal trading. A VPN login escalates the alert, as do several bank accounts linked in a short period.

The data it needs. Blockchain analytics on source wallets, deposit and withdrawal logs, trading activity, linked bank accounts and login IP data with VPN detection.

Case. According to FIU-India's Annual Report 2024-25, a VDA service provider filed a priority STR against a husband, a wife and their company. FIU-India then analysed 11 VDA accounts the three held at other providers and found ₹1,100 crore in deposits from private wallets and unregistered offshore providers. Those deposits had been received without consideration and converted into rupees, which led FIU-India to suspect hawala routed through VDAs. The investigation that followed found the suspected main perpetrator serving a prison sentence abroad for stealing more than $20 million through spoofed crypto exchange websites.

13. Sanctions evasion

In the account. KYC documents place the customer in one country, while logins, phone numbers or devices point to a sanctioned jurisdiction, often behind a VPN. Counterparties may sit in sanctioned places or be blocked persons.

The rule. Whatever the KYC record shows, a session or transaction is flagged when login IP geolocation, phone country code or device data indicates a comprehensively sanctioned jurisdiction. If documented residence and observed location disagree more than once, the account is restricted and reviewed.

The data it needs. Login IP and geolocation with VPN and proxy detection, and phone country codes, all compared against the KYC address and documents. Sanctions screening of customers and counterparties runs alongside.

Case. OFAC announced on 21 November 2023 that Binance had agreed to pay $968,618,825 to settle 1,667,153 apparent violations of multiple sanctions programmes. Between August 2017 and October 2022 the exchange matched U.S. users with users in sanctioned jurisdictions or with blocked persons. OFAC also found that Binance kept allowing trades by users logged in from an IP address in a comprehensively sanctioned jurisdiction, provided they had submitted KYC documents from a non-sanctioned one. The case is a platform’s own control failure, and OFAC found management encouraged VPN use, rather than customers evading a diligent platform; it still shows why location signals must be tested against KYC data.

How to turn a typology into a monitoring scenario

Until it is written as a scenario that runs on the entity's own data, a typology does little for a monitoring team.

1. Scenario work starts from the entity's risk assessment: the products, channels, customers and geographies it rates high risk determine where effort goes.
2. Applicable typologies come next: a cash-heavy cooperative bank puts structuring and funnel activity first, a payment aggregator mule and cyber-fraud flows, and a VDA service provider wallet-based layering.
3. Each typology's data has to exist: several rules above depend on device data, registry records or customs documents held outside core banking, and a rule missing its data produces nothing, or noise.
4. Each rule is drafted first in plain language, because logic the compliance team cannot state in a sentence is hard to defend.
5. Thresholds differ by segment. A level suited to salaried retail customers floods a trade-finance book with alerts, while retail mules slip past a threshold calibrated for traders.
6. Back-test on past transactions, against cases that ended in an STR, before go-live.
7. Once a scenario is live, compare its alerts with the reports filed and adjust it if it generates volume without results.
8. Fresh material from FIU-India guidance, FATF reports or enforcement orders prompts a review for patterns the existing scenarios may miss.

India's STR and CTR obligations and filing timelines are covered in transaction monitoring in India. The thresholds in this post are illustrative and do not constitute legal advice; each entity sets its own against its risk assessment and the directions for its entity type.

Fewer alerts go nowhere when rules are tuned per segment and run over data that already links customers, accounts and counterparties. KYC Hub's transaction monitoring software runs its rules over a single data model of that kind. In one published case study, KYC Hub reports an 80% reduction in false positives for a digital bank.

Each of the five FIU-India annual-report cases above rested on a reporting entity's filing: STRs, CTRs, a priority STR or a typology submission.